Hackers Steal Secrets From 1,835 GitHub Projects, Including AI Keys

A campaign dubbed wfx-loot has used thousands of hijacked GitHub accounts to slip credential-stealing code into software projects, and researchers have confirmed that the malware ran and stole secrets from at least 1,835 repositories, according to Hackread.

The stolen material includes cloud access keys and passwords for artificial intelligence services, which can give attackers a foothold in the systems developers use to build and ship software. Security firms say the activity is still going.

The attack by the numbers

4,837 compromised accounts: Aikido Security counted this many hijacked GitHub accounts opening test pull requests.
61,764 repositories targeted: The count covers every project that received a probe, not every project that ran the malware, Hackread reported.
1,835 repositories confirmed hit: Researchers say the malicious code executed and stole secrets in at least this many.
About 92% still open: According to The 420.in, roughly this share of the suspicious pull requests had not been closed, suggesting many owners did not notice them.
About 1,500 lines: The length of the shell script that hunts for secrets.
8,093 repositories: OX Security counted this many public repositories with malicious commits, along with more than 66,200 probe pull requests. Those figures measure different stages of the attack and should not be mixed up with Aikido’s numbers.

How the attackers got in

The campaign began around 12:45 UTC on Nov. 10, according to The 420.in. Attackers opened pull requests titled “docs: dependency audit notes” from branches named wfx-docs, an Aikido researcher said, to test whether the stolen credentials could write to a repository. The probe itself did not carry the stealer. Where access allowed, attackers followed with malicious commits made to look like routine maintenance.

Aikido first documented three delivery methods: changes to existing GitHub Actions workflows, npm installation hooks and new workflows on temporary branches. StepSecurity later found a fourth, hiding the payload in shell scripts that automated workflows already run, which can leave the workflow file itself untouched.

The script searches for GitHub tokens, cloud credentials, SSH and GPG keys, environment files and Kubernetes settings. It also goes after credentials for AI services including OpenAI, Anthropic and Google Gemini. Afterward the attackers revert their changes and delete workflow runs and logs, sometimes within a minute.

Who was caught up

The 420.in reported that some compromised accounts belonged to Fortune 100 companies, the U.S. General Services Administration, the French government, and groups including Nextcloud and WebdriverIO. StepSecurity documented malicious commits in Nextcloud and WebdriverIO repositories, but reported that no WebdriverIO package release was affected. Those findings show activity in specific repositories, not a breach of every system those organizations run.

Fly.io said in a Nov. 12 notice that an unauthorized party used tokens issued to its GitHub App against customer repositories. A deployment step had left an access token in a file that some applications served publicly. Fly.io said a small number of accounts were misused, that it revoked every user token issued to the app and that its own systems were not breached. Researchers say this explains how some credentials were obtained, but not the source of every hijacked account.

What it means for developers and their employers

Because the script can try to turn repository access into cloud access, a single compromised workflow can reach well beyond the code itself. Hackread noted that the script’s capabilities, such as creating AWS access keys or changing role trust policies, depend on the permissions each workflow has and are not confirmed outcomes in every affected project.

Cleanup is not simple. Deleting the malicious code does not revoke credentials already stolen, and rotating one exposed secret does not remove a new access key or identity credential an attacker has already created.

The campaign also reached published packages. Aikido identified malicious content in a Packagist package and in workflow files bundled with versions of a Go module. For the Go versions, the source code and release binaries were unchanged, and installing a Go module does not run its workflow files.

What happens next

Researchers advise repository owners to review activity since Nov. 10 for unfamiliar wfx-docs branches, dependency-audit pull requests and commits presented as maintenance, and to replace exposed credentials and review cloud permissions if anything malicious turns up. StepSecurity says newer samples send stolen data only through Telegram, starting around 05:30 UTC on Nov. 12, so blocking the first published server addresses does not stop them.

Around Prague, based on reporting by The 420.in, Hackread

Share: Telegram WhatsApp